Microsoft Playwright vulnerabilities

2 CVEs affecting Microsoft Playwright, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-9611, published 2026-01-07.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-9611, published 2026-01-07. High severity, CVSS 7.2. EPSS: 1.2% chance of exploitation in the next 30 days. Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web…
• CVE-2025-59288, published 2025-10-14. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.